apiVersion: logging.kubesphere.io/v1alpha2
kind: Filter
metadata:
  labels:
    logging.kubesphere.io/enabled: 'true'
    logging.kubesphere.io/component: "auditing"
  name: filter-auditing
  namespace: kubesphere-logging-system
spec:
  filters:
    - parser:
{% if (logging.containerruntime is defined) and (logging.containerruntime == 'containerd' or logging.containerruntime == 'crio' ) %}
        keyName: message
{% else %}
        keyName: log
{% endif %}
        parser: json
    - modify:
        conditions:
          - keyDoesNotExist:
              AuditID: ''
        rules:
          - add:
              ignore: 'true'
    - grep:
        exclude: ignore true
  match: kube_auditing

